Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.5.0. By manipulating the "orderType" parameter and the ordering of the returned content using an SQL injection attack, an attacker can extract the username of the user with ID 1 from the "user" table, one character at a time. Users are advised to upgrade to Apache InLong's 1.6.0 or cherry-pick [1] to solve it.
https://programmer.help/blogs/jdbc-deserialization-vulnerability-learning.html
[1] https://github.com/apache/inlong/issues/7529 https://github.com/apache/inlong/issues/7529
References
| Link | Resource |
|---|---|
| http://www.openwall.com/lists/oss-security/2023/04/11/2 | Mailing List Third Party Advisory |
| https://lists.apache.org/thread/mrh4nr3jrlbj6nxkn4q8hddbfh1pnok0 | Mailing List |
Configurations
Configuration 1 (hide)
|
History
18 Apr 2023, 19:30
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Apache
Apache inlong |
|
| CPE | cpe:2.3:a:apache:inlong:1.4.0:*:*:*:*:*:*:* cpe:2.3:a:apache:inlong:1.5.0:*:*:*:*:*:*:* |
|
| References | (MISC) http://www.openwall.com/lists/oss-security/2023/04/11/2 - Mailing List, Third Party Advisory | |
| References | (MISC) https://lists.apache.org/thread/mrh4nr3jrlbj6nxkn4q8hddbfh1pnok0 - Mailing List | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.3 |
11 Apr 2023, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
11 Apr 2023, 17:21
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-04-11 15:15
Updated : 2023-12-10 15:01
NVD link : CVE-2023-30465
Mitre link : CVE-2023-30465
CVE.ORG link : CVE-2023-30465
JSON object : View
Products Affected
apache
- inlong
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')